Re: [PATCH v2 4/4] landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER

["Mickaël Salaün" <mic@digikod.net>]

On Sun, Nov 08, 2026 at 09:23:51PM +0100, Günther Noack wrote:
> The LANDLOCK_ACCESS_FS_REFER right is handled implicitly in a ruleset,
> but only if any other filesystem access right is declared as handled
> in the given ruleset.
> 
> The old documentation was still a remnant from the times when
> filesystem access rights were the only access rights that existed in
> Landlock, but it became misleading when we introduced additional types
> of access rights.
> 
> Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> ---
>  include/uapi/linux/landlock.h | 17 +++++++++--------
>  security/landlock/access.h    |  9 +++++----
>  2 files changed, 14 insertions(+), 12 deletions(-)
> 
> diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
> index 24510e5d8479..7e38b9d1bf12 100644
> --- a/include/uapi/linux/landlock.h
> +++ b/include/uapi/linux/landlock.h
> @@ -22,10 +22,10 @@
>   * enacted.  Vice versa, access rights that are not specifically listed here are
>   * not going to be denied by this ruleset when it is enacted.
>   *
> - * For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
> - * by default, even when its bit is not set in @handled_access_fs.  In order to
> - * add new rules with this access right, the bit must still be set explicitly
> - * (cf. `Filesystem flags`_).
> + * For historical reasons, as soon as any filesystem access right is handled in
> + * @handled_access_fs, the %LANDLOCK_ACCESS_FS_REFER right is always denied as
> + * well.  In order to add new rules with this access right, the bit must still
> + * be set explicitly (cf. `Filesystem flags`_).
>   *
>   * The explicit listing of *handled access rights* is required for backwards
>   * compatibility reasons.  In most use cases, processes that use Landlock will
> @@ -462,10 +462,11 @@ struct landlock_capability_attr {
>   *   This access right is available since the second version of the Landlock
>   *   ABI.
>   *
> - *   This is the only access right which is denied by default by any ruleset,
> - *   even if the right is not specified as handled at ruleset creation time.
> - *   The only way to make a ruleset grant this right is to explicitly allow it
> - *   for a specific directory by adding a matching rule to the ruleset.
> + *   This is the only access right which is denied by default by any ruleset
> + *   that handles filesystem access rights, even if the right is not specified
> + *   as handled at ruleset creation time.  The only way to make a ruleset grant
> + *   this right is to explicitly allow it for a specific directory by adding a
> + *   matching rule to the ruleset.
>   *
>   *   In particular, when using the first Landlock ABI version, Landlock will
>   *   always deny attempts to reparent files between different directories.
> diff --git a/security/landlock/access.h b/security/landlock/access.h
> index f9eaa2f53686..c4a81f7dadeb 100644
> --- a/security/landlock/access.h
> +++ b/security/landlock/access.h
> @@ -18,10 +18,11 @@
>  #include "limits.h"
>  
>  /*
> - * All access rights that are denied by default whether they are handled or not
> - * by a ruleset/layer.  This must be ORed with the .handled field of all
> - * domain->layers[] entries when we need to get the absolute handled access
> - * masks, see landlock_upgrade_handled_layer_config().
> + * All filesystem access rights that are denied by default as soon as any other
> + * filesystem access right is handled, even if the access right is not
> + * explicitly declared to be handled itself.  This must be ORed with the
> + * .handled field of all domain->layers[] entries when we need to get the
> + * absolute handled access masks, see landlock_upgrade_handled_layer_config().
>   */
>  /* clang-format off */
>  #define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \

This is good, but it should also be extended to
landlock_upgrade_handled_layer_config()'s and
reparent-exdev_layers_rename[12]'s comments.

> 
> -- 
> 2.56.0
> 
>